Re: Suppress versus #Rule for performance.

[Joel Esler <jesler () sourcefire com>]

On May 20, 2010, at 4:55 PM, Bill Pickens wrote:

> Hello Everyone,
> After Snort has loaded....
>  
> Is there a difference in Snort performance between suppressing a rule or "#" commenting the rule out?
>  



Commenting out a rule turns the rule off, which means that content does not need to be memorized, therefore -- faster.

Suppressing a rule just turns off the alert, the rule is still being ran.

--
Joel Esler







------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users